ThreatFox: AMOS IOCs

Hunt Hypothesis

This hunt targets the presence of seven known indicators of compromise associated with the AMOS malware family, which is frequently deployed to establish persistence and execute malicious payloads within Azure environments. Proactively searching for these IOCs allows the SOC to identify compromised assets early, mitigating the risk of lateral movement and data exfiltration before the adversary can fully establish a foothold in the tenant.

IOC Summary

Malware Family: AMOS Total IOCs: 7 IOC Types: url, sha256_hash, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AMOS
let malicious_domains = dynamic(["loombronze.com", "forgewillow.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - AMOS
let malicious_urls = dynamic(["https://loombronze.com/contact", "https://forgewillow.com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/kis/update"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AMOS
let malicious_hashes = dynamic(["233fd2c05865e6fc7034e61bf98e64f7afeb24c1b3e88539895eeff764ebb740", "610ae82d0d872334ba68718030bdeb0c2d23ce592b4c9022fbb225b0208b884a", "ec780ca8df9d10df905f3f77641f88ece7651303843802c37a57c484c6251a42"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AMOS

False Positive Guidance

• Legitimate Software Update via Scheduled Task: The AMOS IOCs may include specific file paths or hash values associated with common update mechanisms. For example, a scheduled task running wuauserv (Windows Update) or a third-party updater like AdobeUpdater.exe might write to a location or create a file that matches one of the 7 IOCs.

  • Filter/Exclusion: Exclude processes initiated by the Task Scheduler service (svchost.exe with LocalService or NetworkService) or specific known updater executables (e.g., AdobeUpdate.exe, MicrosoftUpdate.exe) if the IOC is based on file creation or process command line.

• Antivirus Quarantine or Cleanup: Security tools like CrowdStrike, SentinelOne, or Microsoft Defender often create temporary files or quarantine archives in specific directories (e.g., C:\ProgramData\Microsoft\Windows Defender\Quarantine) that may match file path or hash IOCs.

  • Filter/Exclusion: Exclude events where the parent process is a known EDR/AV agent (e.g., CrowdStrikeSensor.exe, SentinelOneAgent.exe, MsMpEng.exe) or where the file path contains standard quarantine directory names.

• Developer or QA Testing Environment: Developers or QA teams may intentionally deploy test builds or staging versions of applications that share naming conventions or file structures with the AMOS IOCs. For instance, a test application named amos_test.exe or a debug build placed in a temporary folder might trigger a hash or name-based IOC.

  • Filter/Exclusion: Exclude hosts tagged as dev, qa, or staging in your CMDB, or exclude file paths under common development directories (e.g., C:\Users\<user>\AppData\Local\Temp, C:\dev, `C:\qa